Get started

Responsible Disclosure

Cint believes that everybody should be safe and secure on the Internet. Cint is committed to maintaining the security of our assets, systems, and customers’ information. If any potential vulnerabilities are identified in any product, system, or asset belonging to Cint, we encourage security researchers to contact us as soon as possible.

Cint does not operate a bug bounty program and will not provide a reward or compensation in exchange for reporting potential issues.

Guidelines

  • Do not engage in any activity that can cause potential or actual harm to Cint, Cint customers, Cint team members, or anyone else.
  • Do not engage in any activity that can potentially or actually degrade Cint services or assets.
  • Do not store, share, alter, or destroy Cint data. If any Confidential Information, Proprietary Information, or Personal Data (data which may be used to identify a person or household) is identified, you must immediately cease activity, remove related data from your system, and immediately contact Cint.
  • Do not conduct any activity that violates local, state, or national law.
  • Do not initiate any fraudulent transactions.
  • Do not disclose any reported issues to third-parties, or publish such reported issues publicly.
  • By acting in accordance with the guidelines above and responsibly submitting your findings to Cint, Cint agrees not to pursue legal action against you unless it is compelled to do so by a regulatory authority, third-party, or applicable laws.
  • Where possible, Cint shall use commercially reasonable endeavors to keep you reasonably informed of the status of any validated vulnerability that you report.

Out of Scope

  • Invalid or missing SPF/DKIM/DMARC records
  • Clickjacking/UI redressing
  • Vulnerabilities only exploitable in older browsers or platforms
  • Theoretical vulnerabilities without providing actual proof of concept
  • Reports from automated vulnerability scanners
  • Reports of unsafe SSL/TLS cipher suites or protocol version
  • Tab-nabbing
  • Self-XSS
  • Content spoofing, mixed content warnings
  • CSRF with low-value security impact (Login, logout)
  • Missing HTTP security headers (i.e. CSP, X-Frame-Options, Content sniffing, HSTS, HPKP etc.)
  • “HTTP Host/Referer Header” XSS
  • Missing cookie security flags
  • Content or text injection issues that are mitigated by CSP Headers
  • User enumeration attacks
  • Phishing (e.g., HTTP Basic Authentication Phishing)
  • Disclosure of known public files or directories or internal IPs
  • Reports on assets that do not belong to Cint
  • Software version disclosure

Reporting

Please include details of the vulnerability, how it was discovered, its potential impact, and any replicable steps or code.
Email your findings to “security @ cint . com”

Disclaimer

All aspects of Cint’s security process and policies are subject to change without notice. Your use of the information contained herein is at your own risk. Cint reserves the right to take action against anyone who engages in any activity which we deem harmful, malicious, unlawful, offensive, or abusive, or that violates the rights of any person or entity.